lib/tevent/echo_server.c set socket close on exec

Set SOCKET_CLOEXEC on the sockets returned by accept.  This ensures that
the socket is unavailable to any child process created by system().
Making it harder for malicious code to set up a command channel,
as seen in the exploit for CVE-2015-0240

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/lib/tevent/echo_server.c b/lib/tevent/echo_server.c
index 6e7f1811f42fe3388be758ec2db389f5a1bf79fb..3b2122dac114a21eb14ae5216d587e8216be4e68 100644 (file)
--- a/lib/tevent/echo_server.c
+++ b/lib/tevent/echo_server.c
@@ -118,6 +118,7 @@ static void accept_handler(struct tevent_context *ev, struct tevent_fd *fde,
                tevent_req_error(req, errno);
                return;
        }
+       smb_set_close_on_exec(state->listen_sock);
        state->sock = ret;
        tevent_req_done(req);
 }